patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10124, bug: LWIP_DHCP_MAX_DNS_SERVERS...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10124: bug: LWIP_DHCP_MAX_DNS_SERVERS < DNS_MAX_SERVERS is causing memory corruption

Submitted by:  Borys Szefler <bsz>
Submitted on:  Tue 19 Oct 2021 08:33:42 AM UTC
 
Category:  DHCP Priority:  7 - High
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Tue 19 Oct 2021 08:33:42 AM UTC, original submission:  

Bug reproduction:

#define LWIP_DHCP_MAX_DNS_SERVERS 1
#define DNS_MAX_SERVERS 2

Bug cause:
 In above case DHCP_OPTION_IDX_MAX = 9, so dhcp_rx_options_val and   dhcp_rx_options_given tables have size = 9.

 Then in dhcp_parse_reply function(dhcp.c file) we have
decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); which next is causing incrementing decode_idx to 9 and reading/writing above tables with idx = 9 which is causing memory corruption.

Using LWIP_DHCP_PROVIDE_DNS_SERVERS instead of DNS_MAX_SERVERS in
 decode_len = LWIP_MIN(len, 4 * DNS_MAX_SERVERS); resolves this problem

Borys Szefler <bsz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bsz (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-19 bsz Attached File- => Added dhcp_max_servers_memory_corruption_fix.patch, #52123

    Back to the top


    Powered by Savane 3.9